OpenAI has published details on the security architecture behind Codex agents running on Windows. The system uses a hardware-enforced sandbox built on Intel SGX enclaves combined with hypervisor-level file and network quotas. This allows developers to run AI coding assistants that can edit local code without exposing secrets or allowing lateral movement to other systems.
Overview
The sandbox is designed to solve a fundamental tension in agent-based coding tools: the agent needs write access to the codebase to be useful, but unrestricted access creates a security risk. OpenAI's approach uses hardware isolation rather than software-only containment. The architecture achieves sub-100 ms latency, which the company describes as a first for production-grade agent isolation on consumer hardware.
How it works
The sandbox operates at two levels:
- Intel SGX enclaves provide hardware-enforced memory isolation. Code running inside the enclave cannot be read or modified by the host operating system or other processes, even if the host is compromised.
- Hypervisor-level quotas control file system access and network connectivity. The agent can read and write only to designated project directories, and network access is restricted to approved endpoints.
This dual-layer approach means that even if the agent is compromised or malicious, it cannot exfiltrate credentials, access files outside the sandbox, or pivot to other systems on the network.
Tradeoffs
The sandbox requires hardware support: Intel processors with SGX capabilities. This limits deployment to relatively recent hardware. The architecture also adds complexity to the development workflow, as the sandbox must be configured with appropriate file and network permissions for each project.
Latency is a key constraint. OpenAI reports sub-100 ms overhead, which is acceptable for interactive coding agents. However, the company does not disclose whether this measurement includes enclave initialization time or only runtime operations.
When to use it
The sandbox is relevant for any organization deploying Codex agents on Windows workstations, particularly in environments where code is proprietary or contains credentials, API keys, or other secrets. It is also useful for multi-tenant scenarios where multiple agents operate on the same machine.
Bottom line
OpenAI's Windows sandbox for Codex demonstrates that hardware-enforced agent isolation is feasible on consumer hardware without unacceptable latency. The architecture is a practical step toward making AI coding assistants safe to use on local codebases, though it requires specific hardware and configuration overhead.